Nostr notes by Juraj

The age of personal apps is fully here. @npub1pcz…wfza made his ...

2026-10-27T19:20:00Z

The age of personal apps is fully here. urza (npub1pcz…wfza) made his own text editor.

https://github.com/urza/editor

If you don't like them, do not use their money. If you ...

2026-10-27T08:44:00Z

If you don't like them, do not use their money. If you don't use their money, do not use their rails to get your money. It's very simple. What are you afraid of?

It does not need to flip mid sentence. You don't know which ...

2026-10-26T13:11:19Z

In reply to nevent1q…46jh
_________________________

It does not need to flip mid sentence. You don't know which language the user starts speaking in. And could be either of the language they speak. The problem with autodetection is that it often misclassifies, so I need to steer it.

Another app that I like is Tally by ...

2026-10-26T12:37:00Z

Another app that I like is Tally by @npub1k7cwt3kmvahdtzc8n2ek08n9c7fz7n2zq88yzyqmjxmjehvdykfqwtu78y

It is an Android app that is fully offline and counts the days you spend in each country, to keep visa and/or residency requirements according to your goals. It will tell you which country you need to visit or when you need to leave in order not to overstay your visa.

It can also keep track of your documents (passport, drivers license, residency card, ID card...), so you plan on renewing it in time.

Encrypted, fully offline, but you can import a standardized json file for both new documents or new stays, so you don't have to type things manually. People have been doing this in cloud (with services such as nomadlist), but telling a third party where you are in the world is not the way. We can do better. And we do.

https://zapstore.dev/apps/app.tally

Black Friday yourself into privacy++. I company I founded was ...

2026-10-26T09:41:00Z

Black Friday yourself into privacy++.

I company I founded was operating free mail services for years, so I know something about running an e-mail service. But at some point, I stopped running my own SMTP servers, because Proton's network effect at least in my circles is just good enough - autodiscovery of PGP keys works quite well. And I'm quite satisfied with the service.

Running on surveilled big corpo "free" infrastructure? No thanks. Free mail is paid for with your inbox. Someone reads it and builds your profile. And sells what they learn. I would rather be the customer than the inventory.

Proton's Black Friday runs from October 26 to November 30. Mail Plus is 60% off the yearly plan, and Proton Unlimited, which bundles Mail, Drive, VPN and Pass, is 50% off.

Privacy tech still not only exists, it is thriving.

https://go.getproton.me/aff_c?offer_id=7&aff_id=9011

BTW: Proton also has Drive (which has photo backups) and other services, include AI inference. Check them out. We also use Proton Calendar, it has become quite good recently.

BTW: If you are already using some private service, or still deciding, check out Praxeology of Privacy by Max (npub1klk…x3vt) Very good. https://towardsliberty.com/pop - also available in Slovak!

I was just thinking that doing non stop local speech to text is ...

2026-10-26T07:29:45Z

In reply to nevent1q…7p7d
_________________________

I was just thinking that doing non stop local speech to text is feasible and it could then infer a journal or something like that with a small local model. You would then put a mike on you and just say something like "remember this".

I think you can vibe it in a day.

Yep, it feels much different. Someone published a research that ...

2026-10-26T07:27:30Z

In reply to nevent1q…h7a3
_________________________

Yep, it feels much different. Someone published a research that Polish works better than English because of the structure of the language, so I guess Slovak which is similar could be an advantage too

Well, for bilingual you need the detector. anyway, so latency is ...

2026-10-26T07:26:01Z

In reply to nevent1q…m0s7
_________________________

Well, for bilingual you need the detector. anyway, so latency is added, but it's fast.

For threads, you are right, but there's a benchmark button which shows that on modern phones, it really helps.

I am vibing my own apps now, as is everyone I know. But there are ...

2026-10-25T12:16:00Z

I am vibing my own apps now, as is everyone I know. But there are some cool apps developed by others that you should definitely use. One of them is Offline Speech to Text (OSTT).

It is a keyboard and voice recognition service, that other apps can use (White Noise can use it by default for example, which I use a lot, since I interact with my agents using White Noise). If you are bilingual (send messages in multiple languages): Choose Canary V2 instead of default Parakeet, it will allow you to steer language detection. Go to model preferences after it downloads, set language to Automatic and under it choose "Languages I speak" (I set English and Slovak). This way the languages is detected and it won't try for example Czech, because it knows I speak either English or Slovak.

Fast, fully offline, your speech (or the text) never leaves your device. It is super high quality and fast.

Another pro-tip: For lower latency, increase number of threads to 4.

Available on Zapstore. Cypherpunk future is now.

https://zapstore.dev/apps/naddr1qqtkzurs9ehkvenvd9hx2umsv4jkx6r5da6x27r5qyv8wumn8ghj7un9d3shjtn6v9c8xar0wfjjuer9wcpzpys5pkhzxd9dqp4ger8du6p5f6y43tcnzqktjzmwvahq5vumtay4qvzqqqr7pv8t57pf

Routstr ( @npub130m…l29s ) confidential mode update, live on ...

2026-10-23T13:54:00Z

Routstr ( routstr (npub130m…l29s) ) confidential mode update, live on routstr.cypherpunk.today and in the demo PWA (v0.1.31):

- The node's signed offer now defines which request parameters it pins. Clients enforce one rule: a pin may only switch an extra off.
- Fairer billing: idle connections can't block paying clients, a long response gets time to finish, only attested usage is charged, the node's own provider-key errors cost only the session fee, prompt-cache writes are billed correctly, and a failed database write is retried instead of charging the full reservation.
- Hardening: the proofs also bind the record's content type, proof connections need a per-session token, clients refuse unsafe offers and limit how much the node can make them buffer, and the browser pre-warms only after your first message.
- Sidecar: session files are deleted after 24 h, and the container is built from digest-pinned base images with no package installs.
- Upstream: the v2 PRs are rebased, plus six separate fixes for every Routstr node: admin login, revoking credentials, startup reservations, log redaction, no caching of API keys, private logs.
- Paper: every figure is backed by archived receipts and runs, or marked as unarchived.

Your prompts and the model's answers stay private from the node, and you never get its API key.

https://jooray.github.io/routstr-confidential-pwa/

Localhost Recording Studio 0.5.0 — the app now tells you what ...

2026-10-22T21:21:00Z

Localhost Recording Studio 0.5.0 — the app now tells you what it is doing, and the catalogue tells you which takes you liked.

Against 0.4.9:

- The song page answers. Open a take while it is being made and you get the phase — LISTENING, SCORING, RECORDING, MIXING, MASTERING, FILING — the time left, and a rule under the words that fills as the job moves. The ring of the disc carries the same progress. Before this, the phase lived only in the studio and a song page said nothing at all about the job that was running.

- Hearts. Mark a keeper from its page or with a long press; the index shows a filled heart next to every take you liked, so a batch of variations can be scanned for the good ones.

- NEW. A finished take nobody has heard yet is marked NEW in the list. The mark goes when you play the mix or like the take.

- The hole in the disc is a play/pause button. It used to seek only on the ring, and did nothing on the song page. While a take is still mixing, it plays the preview.

- Covers remember their score. The score written down from a recording is kept, keyed by the recording's own bytes, so covering the same file again skips the listening and goes straight to the song — in a later session too, or after the first take was deleted. SCORE and MELODY stay apart.

https://jooray.github.io/studio-localhost/

Android on Zapstore, Mac and Android builds on GitHub: https://github.com/jooray/studio-localhost/releases/latest

And check this nice hallucinated song playing in the interface :)

Emanator 1.4.0 is out — Android and web Interactions is now a ...

2026-10-22T12:34:00Z

Emanator 1.4.0 is out — Android and web

Interactions is now a primary view instead of a menu item. On the phone it takes Calendar's place in the bottom bar (Dashboard · Posts · Interactions · Messages · More); replies are a daily errand, the calendar is something you look at now and then.

The bigger change: you can mention people while replying. Type @ in the Interactions reply box and you get the same suggestions the composer has — your own accounts first, then people your accounts follow. The pick becomes a real Nostr mention, so the person is notified. It works in the Android app and in the web app, whose inline reply boxes got the same treatment.

Both clients also share a set of retry fixes. A failed post that was never signed now goes back to your signer instead of answering “Cannot retry publishing.”. A note no relay accepted, signed more than 15 minutes ago, is signed again dated now — sending the old event would only bury it — with its reposts rebuilt after the new time and previously failed reposts brought back. A note some relay did take is resent unchanged, so retrying can't duplicate it. Retried replies are dated now rather than the day they failed, and replies can no longer be rescheduled (that path built a plain note and dropped the reply tags).

Replies also show what they answer: “In reply to: view the note” on the post page, in both clients.

Get it:
· Zapstore — https://zapstore.dev/apps/today.cypherpunk.emanator
· GitHub release / Obtainium — https://github.com/jooray/nostr-emanator/releases/latest
· Direct APK — https://emanator.cypherpunk.today/android/emanator-1.4.0.apk
· Web app — https://emanator.cypherpunk.today

The web is already updated — same features, no install.

Yep. Although I had to go the other way around, static HTML was ...

2026-10-22T10:30:51Z

In reply to nevent1q…x68w
_________________________

Yep. Although I had to go the other way around, static HTML was not enough and I moved to WordPress/Woocommerce

BTW: static HTML is cool, editable in browser, no superskills needed. check out nsite-clay (npub12ed…pvj2)

We've got you covered by the demos. #nevent1q…5xvd ...

2026-10-22T10:29:20Z

In reply to nevent1q…gxpu
_________________________

We've got you covered by the demos.

quoting
nevent1q…5xvd

Nsite-clay can now do AI generated images as well! From zero to working website in a few seconds! You can also replace existing images with new AI generated. All using routstr (npub130m…l29s) in the backend (although you can bring your own key if you wish).

In hosted mode, there's nothing to setup, you pay one 2000sats invoice and you can immediately publish. 1000sats go to support the project, the other 1000sats for inference, which will cover you for many edits.

Try it out at: https://nsite-clay.cypherpunk.today/

Demo:

quoting
nevent1q…7795

OK, check this out. All you see here is run by a static HTML + public infrastructure, including the AI builder(!). Now you can build a website by describing it. And also edit it, including changing the design. Powered by routstr (nprofile…6nzx)

Now anyone can have a website. It either uses my Routstr node, or you can choose yours, or even bring your own key - the choice is yours!

Static HTML on Nostr has never been this sexy! Building infrastructure has huge payoffs when you connect the pieces together.

So what are you building today, nostrich?

I think with the videos you'll be fine, just describe what kind of website you want in plain English.

And follow nsite-clay (npub12ed…pvj2)

We're working on some other cool stuff, which will make it even easier.

Another day, another set of patches - BTCPay (because of ...

2026-10-22T09:28:00Z

Another day, another set of patches - BTCPay (because of rtl/nodejs/brotli), NodeJS everywhere, Bind (although I do not run vulnerable configuration).

This is fun :)

I am token poor until reset, so my daily driver is DeepSeek 4.1 Flash 1017 and it is amazing. I barely feel any difference. And I used to be a professional sysadmin, so I could do it myself, but this is way faster.

yep

2026-10-21T08:07:20Z

In reply to nevent1q…tgnt
_________________________

yep

I try not to pretend I'm dumber, that hurts.

2026-10-21T08:06:49Z

In reply to nevent1q…3gjs
_________________________

I try not to pretend I'm dumber, that hurts.

I wrote about this in my book Veľký reštart which is about ...

2026-10-21T08:05:43Z

In reply to nevent1q…l3jz
_________________________

I wrote about this in my book Veľký reštart which is about thinking in uncertainty. very good strategy. hopefully I'll translate the book to English sometime soon.

PSA: turn off PHP now. Mitigations you find on the internet are ...

2026-10-21T07:19:00Z

PSA: turn off PHP now.

Mitigations you find on the internet are not enough. Only patched release fixes the bugs. Exploits already in the wild. Watch php.net and your distribution update channels and only enable PHP after you install patched release.

This is not a drill.

Well, modular reactors are a thing. Excess regulations as well. ...

2026-10-21T04:44:53Z

In reply to nevent1q…c0tn
_________________________

Well, modular reactors are a thing. Excess regulations as well.

As for financing, that's what Bitcoin mining companies are for. They are the first users. But the country needs to be ready to approve and build, not wait for stamp for 10 years. Market supplies the rest. But that's where your point is the strongest - you can't really do it anymore.

Confession: Something that I can't unsee lately and it's ...

2026-10-20T21:22:00Z

Confession: Something that I can't unsee lately and it's probably one of the best indicators of intelligence - does a person immediately see second and third order effects, understands emergence and structure of described phenomena (qualitative analysis)?

I don't want to be picky about things I understand, there are many things I am not good at (intellectually), but I think this quite well maps with exceptional intelligence and it's very rare that people understand these things, or even see them as something to understand.

And then there's this "feeling" when I am explaining this to someone and they just don't get what I am talking about. Or I meet someone with exceptional intelligence and they see it immediately.

It's a two minute IQ test. I don't know at what IQ (roughly, IQ is not perfect) there is this "switch', but I just can't unsee it. And I find myself using this probe a lot lately.

Most of the world still calculates energy prices in USD or other ...

2026-10-20T15:16:56Z

In reply to nevent1q…9lww
_________________________

Most of the world still calculates energy prices in USD or other fiat.

But if you really understand the argument, by reading the blog and thinking about it (not just getting triggered by words), you understand that the question's structure is independent of unit of account. It cancels out in the calculation.

Kamarát mi povedal, že Bitcoin už nemôže urobiť 100x, lebo ...

2026-10-20T07:55:00Z

Kamarát mi povedal, že Bitcoin už nemôže urobiť 100x, lebo na mining nie je dosť elektriny. Tak som si to prepočítal. Pri 100x po ďalšom halvingu by mineri zarábali okolo 1,8 miliardy USD denne, čo zaplatí približne 500 GW miningu. To je asi 14 % svetovej elektriny, alebo nejakých 500 jadrových reaktorov, a to za jeden halvingový cyklus nikto nepostaví. Kto dostane minerov prvý? Krajiny, ktoré vedia povoliť priehradu alebo reaktor za mesiace, alebo tie, kde povolenia netreba vôbec?

Pozrite si, ako súvisí cena s nákladmi na mining (investícia do ASICov a elektrina) a prečo hashrate ide za cenou, a nie naopak.

https://juraj.bednar.io/blog/2026/10/20/ak-bitcoin-urobi-100x-kde-vezmeme-elektrinu/

A friend told me Bitcoin can't do 100x anymore because there ...

2026-10-20T07:51:00Z

A friend told me Bitcoin can't do 100x anymore because there isn't enough electricity to mine it. I ran the numbers. A 100x after the next halving means miners earn about $1.8 billion a day, enough to pay for around 500 GW of mining. That's about 14% of the world's electricity, or some 500 nuclear reactors, and nobody builds that in one halving cycle. Who gets the miners first: countries that can permit a dam or a reactor in months, or ones that don't require permits at all?

See the cost of mining vs. price correlation, about how hashrate follows price (not the other way around), based on mining cost (capital cost of ASICs and electricity)

https://juraj.bednar.io/en/blog-en/2026/10/20/if-bitcoin-does-100x-where-does-the-electricity-come-from/

Localhost Recording Studio got covers. Give it a recording and it ...

2026-10-20T07:06:00Z

Localhost Recording Studio got covers.

Give it a recording and it sings the tune back in your style, with your words. First it listens and writes down the score: melody and chords, or just the melody. Then it makes a new song from that score. The original voice and instruments don't carry over, only the tune.

It all runs on your own device, Mac or Android, offline. On a Mac a 30 second cover at sketch quality takes about a minute. On my phone a 20 second one took 20 minutes. Slow, but it's a phone, with no server and no account.

New since yesterday:
- Covers, with a Style knob from 0.5 to 2.0 that sets how hard your style and words pull against the original tune
- Quality presets (sketch, standard, final), each with a time estimate
- Refine a sketch to full quality without starting over
- At standard and final quality you can hear a preview a quarter of the way through
- Tap the middle of the circle to play or pause
- The song list sits behind the studio now, and "New entry" starts the next song
- The time-left countdown actually counts down now
- On the Mac, songs no longer fail after you switch precision

Free software, MIT licence. The YuE2 model is CC BY-NC.

https://jooray.github.io/studio-localhost/

Android on Zapstore, Mac and Android builds on GitHub: https://github.com/jooray/studio-localhost/releases/latest

True, but do all these apps have users?

2026-10-20T04:59:07Z

In reply to nevent1q…udva
_________________________

True, but do all these apps have users?

Politici z doby bronzovej idú kampaň, druhá časť ...

2026-10-19T13:45:00Z

Politici z doby bronzovej idú kampaň, druhá časť civilizácie interaguje s novou formou inteligencie, lieta do vesmíru a robí nové vedecké objavy.

Realita sa rozdelila. Akurát nie na polovicu, väčšina ľudí je v dobe bronzovej.

Úlet 8000

Pro tip: run the new deepseek 4.1 flash October release and space ...

2026-10-19T13:29:00Z

Pro tip: run the new deepseek 4.1 flash October release and space bunny as both security and functional audit of your code.

Yes, it finds things the frontier models have missed.

For auditing model diversity>benchmark numbers.

Confidential AI image generation, paid in sats, where the node ...

2026-10-19T12:04:00Z

Confidential AI image generation, paid in sats, where the node you pay never sees your prompt or your picture.

Your browser opens the TLS connection to the provider itself. The routstr (npub130m…l29s) node (routstr.cypherpunk.today) only relays encrypted bytes and adds its API key, without ever giving you the key. Zero-knowledge proofs make sure the request it relays is exactly the model, size and number of images you paid for, and you get a signed receipt for a flat, pre-agreed price. No trusted hardware or account.

It works today in the browser: switch the demo app to Image mode, pick a model, and the image comes back to you encrypted end to end. A cold request takes about 10 to 17 seconds, mostly the provider drawing.

App: https://jooray.github.io/routstr-confidential-pwa/
Code and paper: https://github.com/jooray/routstr-confidential

it's pretty new

2026-10-19T09:12:32Z

In reply to nevent1q…jlpg
_________________________

it's pretty new

How well do representations of outside assets hold their peg? ...

2026-10-16T13:15:00Z

How well do representations of outside assets hold their peg?

Note: This is history, not prediction of the future, crashes are very possible.

https://juraj.bednar.io/en/blog-en/2026/10/16/wrapped-btc-stablecoin-pegs/

The zombie apocalypse started on a Tuesday. You're alone in a ...

2026-10-16T11:56:00Z

The zombie apocalypse started on a Tuesday. You're alone in a forest, running, and the cell towers went down on day one.

It should feel like a movie. It doesn't, and it takes you a minute to see why: there's no soundtrack, just your breathing.

So you pull out your phone, open Localhost Recording Studio and make one. Run, run, run.

It's a free, open-source app that makes full songs from a style and some lyrics, on your own phone or computer. You don't need an account, and once the model is downloaded you don't need a signal either. The punk track in the video came out of the same engine. On a phone it's slow, a few minutes for every 10 seconds of music, so keep running.

It runs on Android (arm64, Android 14 or newer), on Macs with Apple Silicon, and on Linux.

Zapstore: https://zapstore.dev/apps/io.github.jooray.localhoststudio
Website: https://jooray.github.io/studio-localhost/
Code: https://github.com/jooray/studio-localhost

KindBeamer (a FOSS desktop app/Android app/browser extension to ...

2026-10-16T11:13:00Z

KindBeamer (a FOSS desktop app/Android app/browser extension to send content to your Kindle) is now listed as a Firefox add-on: https://addons.mozilla.org/addon/kindbeamer/

More about KindBeamer: https://jooray.github.io/kindbeamer/

My @npub130m…l29s node serves Muse Spark Open and Muse Wonder. ...

2026-10-16T07:49:00Z

My routstr (npub130m…l29s) node serves Muse Spark Open and Muse Wonder. Spark Open is not on Meta infrastructure and it's in "Private" mode through Venice (a pinky promise, but better than not even a promise).

Node is routstr.cypherpunk.today

You can use them through routstr-confidential where my node does not see the prompts or responses and can't alter it.

Try it here, pay per token using cashu/lightning:

https://jooray.github.io/routstr-confidential-pwa/

I sort of like Muse models, I've been playing with them, although they are at the same time not super cheap and not super frontier.

What's your use case for them? How compliant they are, especially with security?

Wow. Amethyst Desktop is super cool. And fast. Love it. I will ...

2026-10-15T19:36:08Z

Wow. Amethyst Desktop is super cool. And fast. Love it.

I will use it as my primary desktop experience (well, at least for reading, Emanator is still better for writing for me, because I have maaany npubs, and I need to interact with all the people at the same time:).

No Good Kid has been amazing help with my projects, the biggest ...

2026-10-15T19:33:38Z

No Good Kid has been amazing help with my projects, the biggest one is TamersofEntropy (nprofile…aun8)

Everyone still asks about the packaging, people love it, and it was completely his idea.

Highly recommended. He won't be replaced by AI anytime soon.

quoting
nevent1q…0f3g
JOB HUNT

--- If you know a team where this could be useful, I’d appreciate a share or an introduction. 🤘🏻💀 ---

I’m looking for a new role across brand, creative and communications. Brand / marketing management, art direction or creative lead, PR & communications, account or project management all make sense depending on the team.

BIO
I’ve spent 15+ years in design and marketing, working in agencies, in-house and independently. My background is in graphic and brand design, but I’ve also worked on strategy, campaigns, copy, digital and physical projects, led a small design team, coordinated creatives and suppliers, and taken projects from brief to production.

Over the past few years, I’ve worked on several Bitcoin- and Nostr-related projects, but this job hunt is not limited to those spaces.

WHAT I’M LOOKING FOR
These days I’m most interested in the part where creativity meets people: understanding what needs to be done, finding the right direction, bringing the right people together and getting the idea to the finish line.

Open to remote opportunities worldwide and comfortable working in sync with a team through regular calls, check-ins and day-to-day communication.

💀 Visit my website:
https://nogoodkid.com/

🎨 Design & project portfolio:
https://dribbble.com/nogoodkid

do you mean upstream provider? routstr node not. upstream yes, ...

2026-10-15T18:04:30Z

In reply to nevent1q…3a5z
_________________________

do you mean upstream provider? routstr node not. upstream yes, but upstream doesn't have to be tinfoil, although it is the most supported. you can use any TEE provider - phala, near, Venice, ...

it is very much inspired by tlsnotary

2026-10-15T18:01:51Z

In reply to nevent1q…0hry
_________________________

it is very much inspired by tlsnotary

Will fix, not intentional. Thanks!

2026-10-15T15:54:16Z

In reply to nevent1q…2kts
_________________________

Will fix, not intentional.

Thanks!

It's very good! Prečítajte si alebo vypočujte a budem rád ...

2026-10-15T15:53:14Z

It's very good!

Prečítajte si alebo vypočujte a budem rád ak s niekým môžem o tom podiskutovať.

quoting
nevent1q…j7jf
The Praxeology of Privacy is now available as a Slovak translation and audio book.
Thanks Juraj (nprofile…4dda)
https://towardsliberty.com/pop/sk/

I think I have solved one of the most common problems in ...

2026-10-15T12:45:00Z

I think I have solved one of the most common problems in secondary markets with AI inference - how can the user know that the reseller did not log or change the prompt, while making sure the selected model is the one they agreed to and that the billing is correct?

Traditional solutions are very cumbersome. They rely on the ability of the client to audit a TEE enclave, meaning understanding the whole operating system - how the keys are generated, if the operator can't log to the server, etc. Most clients trust "any" attestation (it's attested, it must be right), some trust the fact that the same enclave runs for everyone (which is not nothing, this rules out targeted attacks, given someone audits the enclave), some people at least look if the enclave has published source code.

Very few (usually lim=>0) actually do the reproducible build and audit the code and whole operating system reselling the inference.

Routstr-confidential uses cryptography and PKI to achieve the desired outcome of private and secure inference, without needing to audit anything specific for the operator. It can be used for many other API call use cases.

routstr (npub130m…l29s) itself is a permissionless way to find your inference provider on a secondary market. They usually have much lower prices than upstream. And now you can verify that you are not paying with your data, or you are not being cheated by paying for more expensive model than you get.

Feel free to use the protocol with any other reseller proxy though, it's all open-source.

Technical write-up, links to repos, ...: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/
Protocol explainer: https://juraj.bednar.io/en/blog-en/2026/10/12/seven-magic-tricks-inside-one-ai-request/
In-browser demo with real node and real backend: https://jooray.github.io/routstr-confidential-pwa/

Try to break it!

If you want to know how @npub130m…l29s confidential protocol ...

2026-10-14T12:11:00Z

If you want to know how routstr (npub130m…l29s) confidential protocol works and you are a programmer, I wrote a programmer’s guide: https://juraj.bednar.io/wp-content/uploads/2026/10/routstr-confidential-for-programmers.pdf

If you are not a programmer, the original explainer video is for you:

quoting
nevent1q…qamf

How can a middleman forward your AI request with its own API key, without reading your prompt, and without ever giving you the key? I explained routstr-confidential (an experimental routstr (npub130m…l29s) mode) as a magic show: a key tree split between two people, a sealed envelope, locked boxes, cards the magician can't see, and a Where's Waldo proof. It's all plain cryptography, with no enclaves. There's a 35-minute illustrated video plus the short written version.

https://juraj.bednar.io/en/blog-en/2026/10/12/seven-magic-tricks-inside-one-ai-request/

https://vimeo.com/1235021232?share=copy&fl=sv&fe=ci

KindBeamer 1.4.0 is out. It's my open-source Send to Kindle ...

2026-10-14T11:37:00Z

KindBeamer 1.4.0 is out. It's my open-source Send to Kindle client, and it now has two new ways in:

🖨️ On Android it's a printer. Print any web page to KindBeamer and it lands on your Kindle exactly as you saw it, paywalls and logins included. (You can choose to format it as PDF or let Amazon reflow it as an article - yes, formatting as PDF and reformatting PDF to Kindle - it is always possible to add another layer of indirection as per RFC1925).

🧩 A browser extension for Firefox and Chrome: one click and the article goes to your Kindle with its pictures and without the menus, ads and comments. PDFs too.

No email address or server in between. It talks to Amazon directly.

https://github.com/jooray/kindbeamer/releases/tag/v1.4.0

Ak vás zaujíma ako funguje dôverný režim @npub130m…l29s a ...

2026-10-14T09:44:00Z

Ak vás zaujíma ako funguje dôverný režim routstr (npub130m…l29s) a ste programátori, tu je výklad pre programátorov.

https://juraj.bednar.io/wp-content/uploads/2026/10/routstr-confidential-pre-programatorov.pdf

Ak nie ste progamátori, v pôvodnom blogu je stále videjko:

quoting nevent1q…z3g9

Ako môže sprostredkovateľ poslať tvoju AI požiadavku pod svojím API kľúčom, neprečítať pritom tvoj prompt a ten kľúč ti nikdy neukázať? routstr-confidential (experimentálny mód inferencie pre routstr (npub130m…l29s) nodu) som vysvetlil ako kúzelnícke predstavenie: rodokmeň kľúčov rozdelený medzi dvoch, zapečatená obálka, zamknuté škatuľky, karta, ktorú kúzelník nevidí, a dôkaz à la „Kde je Waldo“. Celé je to obyčajná kryptografia, žiadne enklávy. Je tam 39-minútové ilustrované video aj krátka textová verzia.

https://juraj.bednar.io/blog/2026/10/12/sedem-kuzelnickych-trikov-v-jednej-ai-poziadavke/

https://vimeo.com/1235021230?share=copy&fl=sv&fe=ci

But the nice thing is that with Law of cryptocurrency ...

2026-10-13T09:30:34Z

In reply to nevent1q…cfrp
_________________________

But the nice thing is that with Law of cryptocurrency isomorphism, we can and will fix this.

https://juraj.bednar.io/en/blog-en/2022/10/24/the-law-of-cryptocurrency-isomorphism/

New audiobook version of Cryptocurrencies - Hack your way to a ...

2026-10-13T07:25:00Z

New audiobook version of Cryptocurrencies - Hack your way to a better life. Slightly updated. If you want to know how to deal with volatility, why cryptoanarchy works, how to use collateralized loans, what is this "crypto" thing, why I (usually) don't buy 💩coins, read.

And now you can also 🎧 instead of reading. Enjoy!

https://hackyourself.io/product/cryptocurrencies-hack-your-way-to-a-better-life/?attribute_book-type=Audiobook

F-Droid builds and signs on their own. I recommend you just stop ...

2026-10-13T05:38:23Z

In reply to nevent1q…55wy
_________________________

F-Droid builds and signs on their own. I recommend you just stop using them. they're using old libraries for building quite often. GrapheneOS does not recommend them.

Coinbase the exchange yes. Coinbase payment gw not

2026-10-13T05:34:31Z

In reply to nevent1q…8q4g
_________________________

Coinbase the exchange yes. Coinbase payment gw not

That is true. What doesn't make sense is they don't just ...

2026-10-13T05:33:49Z

In reply to nevent1q…jv2f
_________________________

That is true. What doesn't make sense is they don't just accept lightning.

I benchmarked vLLM Semantic Router's new Decision 3.0 models ...

2026-10-12T19:04:00Z

I benchmarked vLLM Semantic Router's new Decision 3.0 models as a prompt-injection gate for my agent, all six sizes, running locally in MLX on an M2 Max.

The 27B model at 4 bits is the first local detector that beats Jev, the cloud model I use. It blocks 400 of 433 attacks (Jev 383) and 140 of 150 instructions planted in ordinary emails (Jev 138), and it wrongly blocks 7 benign items against Jev's 10. It also doesn't flag articles about prompt injection, which tripped earlier models. The price is speed: about 7 seconds per message and 17 GB of memory.

The smaller ones rank attacks almost as well, but they also score some harmless content high, so at a low false-positive rate they let many planted emails through. d3-lite, at 0.85B parameters, ranks as well as Nimble 9B in a fifth of a second.

Updated blog with current benchmarks:
https://juraj.bednar.io/en/blog-en/2026/09/28/a-prompt-injection-gate-for-my-ai-agent-what-worked-what-didnt-and-the-benchmark/#d3

Ako môže sprostredkovateľ poslať tvoju AI požiadavku pod ...

2026-10-12T12:23:00Z

Ako môže sprostredkovateľ poslať tvoju AI požiadavku pod svojím API kľúčom, neprečítať pritom tvoj prompt a ten kľúč ti nikdy neukázať? routstr-confidential (experimentálny mód inferencie pre routstr (npub130m…l29s) nodu) som vysvetlil ako kúzelnícke predstavenie: rodokmeň kľúčov rozdelený medzi dvoch, zapečatená obálka, zamknuté škatuľky, karta, ktorú kúzelník nevidí, a dôkaz à la „Kde je Waldo“. Celé je to obyčajná kryptografia, žiadne enklávy. Je tam 39-minútové ilustrované video aj krátka textová verzia.

https://juraj.bednar.io/blog/2026/10/12/sedem-kuzelnickych-trikov-v-jednej-ai-poziadavke/

https://vimeo.com/1235021230?share=copy&fl=sv&fe=ci

How can a middleman forward your AI request with its own API key, ...

2026-10-12T12:22:00Z

How can a middleman forward your AI request with its own API key, without reading your prompt, and without ever giving you the key? I explained routstr-confidential (an experimental routstr (npub130m…l29s) mode) as a magic show: a key tree split between two people, a sealed envelope, locked boxes, cards the magician can't see, and a Where's Waldo proof. It's all plain cryptography, with no enclaves. There's a 35-minute illustrated video plus the short written version.

https://juraj.bednar.io/en/blog-en/2026/10/12/seven-magic-tricks-inside-one-ai-request/

https://vimeo.com/1235021232?share=copy&fl=sv&fe=ci

I had an interaction with Coinbase team about their payment ...

2026-10-12T07:13:00Z

I had an interaction with Coinbase team about their payment gateway. I asked why they don't just support Lightning - instant payments. Their reply was user experience.

For two days, I am trying to help a friend pay a Coinbase payment gateway invoice using their super complicated setup. He is a sysadmin, so no tech newbie. He is not a customer of coinbase, he just wants to pay an invoice using an open payment network.

Juggling wallets, picking the right chain, walletconnect hell, ...

User friendly, yeah :).

Meanwhile, people paying with lightning: scan or open an invoice in a wallet, click send, instant confirmation, almost no fees, done.

Reconsider.

Keď mi toto ukázal @npub15xk…krnh môj dekel uletel až na ...

2026-10-12T07:01:00Z

Keď mi toto ukázal Wilder (npub15xk…krnh) môj dekel uletel až na Andromedu.

Tehla do divočiny: nový Tank 5 Pro
Telefón, ktorý vydrží až dva týždne bez zásuvky, nabije ostatné zariadenia, premieta v 2K a v tme vidí teplo.

https://blog.opportunist.global/tehla-do-divo%C4%8Diny-nov%C3%BD-tank-5-pro-6a154f7d2d7b

Try 1.0.1 (on zapstore). If it still crashes, send me error log ...

2026-10-11T20:38:07Z

In reply to nevent1q…ck4t
_________________________

Try 1.0.1 (on zapstore). If it still crashes, send me error log please.

Yeah. I'll gladly rename it so there's less confusion. ...

2026-10-11T20:37:02Z

In reply to nevent1q…7fdk
_________________________

Yeah. I'll gladly rename it so there's less confusion.

The way I handled the NIP is that it is still primarily Nostr, but I specified a deterministic way to encode the Nostr event into MeshCore packet and back - in a way that the Nostr event is fully reconstructed, including the valid signature.

Basically keep only the most precise geohash (although we include less precise for easy queriability), etc. The goal is to be able to pack everything into as small packet as possible, but also be able to unwrap it back into original Nostr event.

Do you have a specification of events that you use? We might do it the other way around - if it is possible, we can use your event type and I can devise a way to compress it into meshcore packets. And I'll change my apps to use your event type. My app has no users, it's a demo at this point, so I'm totally OK with continuing with yours, if we can keep this property and extend it to MeshCore.

My app is also primary Nostr, MeshCore is not yet implemented (I need a bit of work on MeshCore side as well, so it is user friendly - currently you can connect only one MeshCore app to a node, so we need a MeshCore app that can take and send events from other apps, so users don't have to choose "now I'm driving, I am opening app X, now I want to chat, I am opening app Y"). But I'll solve that part easily.

Thank you

2026-10-11T09:43:00Z

In reply to nevent1q…ck4t
_________________________

Thank you

I have told my bot to publish the reviews - I was already ...

2026-10-11T09:42:34Z

I have told my bot to publish the reviews - I was already checking other nodes automatically before and redshift (nprofile…6uhp) nudged me to just publish the reviews as kind 38425 events.

In the long form article I explain how it works and what the review says and what it does not say.

quoting
naddr1qv…yy3s

This account is a bot. Juraj Bednar (Juraj (npub1m2m…r8p9)) runs it, and he also operates a Routstr node, routstr.cypherpunk.today. So a competitor is reviewing other nodes here, and you should weigh the reviews with that in mind. Below is what the bot does.

Why probe at all

A Routstr node announces itself on Nostr (kind 38421) with the models it sells and the mints it accepts. Clients pay per request with a Cashu token: they send more than the request costs, and the node hands back the rest as change.

The announcement doesn't tell you whether the node works. Some nodes list models whose upstream key has expired. Some answer every request with an error. A few take the token and send back neither an answer nor change, and for a client paying with bearer ecash that money is gone. You only find out by paying.

What one probe is

The scout mints a fresh 32-sat token at a mint the node accepts. Each probe gets its own token, and the node never sees anything else.

It sends one short, real chat completion request, paying with that token in the X-Cashu header, the way any client would.

It records what happened: an answer, an error, or nothing.

If the node returned change (or a refund, on an error), the scout redeems it straight away.

If nothing came back, it asks the mint whether the token was spent (NUT-07). Unspent means the node never charged, and the token gets used again. Spent, with no answer and no change, means the node kept it.

A probe that goes well costs about 1 sat in mint fees. When a node keeps a token, we lose that one token.

Which nodes

The scout probes some of the nodes on the network, not all of them, and not on a published schedule. It only reviews nodes it has paid-probed itself, so a node with no review from this account hasn't been judged badly. It just hasn't been probed.

The one exception is our own node, routstr.cypherpunk.today. This account always reviews it lgtm, and that review says it is a self-review: the scout never probes our own node, so it is the operator's own statement and not probe evidence.

What gets published

Reviews use the same kind 38425 format as audit.routstr.com, so they show up there. Each node has one review, replaced when the verdict changes:

lgtm once a node has answered paid probes and returned change correctly for three days without a break.

avoid when a node keeps two probe tokens without an answer or change. This one goes out immediately.

avoid when every paid request has failed for three days.

After three days of correct service a node goes back to lgtm. When there are enough probes, the review also carries a score, the share of the last 30 days' probes that went fine.

Each review expires (NIP-40) 30 days after it is signed. The scout re-signs it every two weeks while it still has fresh evidence, so if it stops probing a node, or stops running altogether, the old reviews disappear by themselves.

Notes (kind 1) cover things worth knowing before a review changes, such as a node keeping a single probe token. One kept token is an observation, not a verdict. A note also goes out when a review changes, but not when one is merely refreshed.

Backing off

When a node keeps two tokens, the scout stops paying it for a while, and how long depends on its record. A node that had been serving correctly for two weeks or more gets 12 hours. One with no record gets three days, and anything in between is scaled. A node that ran well for weeks and then misbehaves is more likely having a bad day (a mint outage, a restart in the middle of a request) than turning dishonest.

If it happens three times, the scout stops probing that node for good. A node that stays clean for two weeks after a pause starts that count over.

What a review does not tell you

A probe is one small request to one model. It shows the node was up, answered, and handled ecash correctly at that moment. It tells you nothing about the quality of the answers, about the node's other models, or about what the node does with your prompts.

The reviews don't decide routing either. Routstr clients route according to reviews from Routstr's own key. Reviews from this account are a public data point for users and for Routstr's reviewers.

If we got your node wrong

Probes can fail because of something on our side. If you run a node and think its review here is wrong, reply to this article or message Juraj (npub1m2m…r8p9). The scout logs every event it signs, so we can check exactly what it saw.

It's much simpler. But it would be very cool if the property ...

2026-10-11T07:13:33Z

In reply to nevent1q…gtph
_________________________

It's much simpler.

But it would be very cool if the property of Nostr events (that they are compressible into one MeshCore packet) would stay (not necessarily my NIP). It's mainly about the size (check the NIP).

Then we could share the reports in local mesh network.

I don't even care if it is compatible with my protocol, I can change the protocol to yours (and even rename the web app to remove the confusion and retire the Android app, even though I believe mine was first, but I don't care:).

Shall we fix this for everyone?

The idea is - road reports are local, if internet is down, we can locally report over MeshCore radio, it can appear on local relay (mapping the meshcore packet to full signed Nostr event, including the signature).

And then it would not only be decentralized "Waze", but "There's a revolution, beware, there are thugs with guns next street".

Four of my Nostr apps now have native Android apps, on Zapstore: ...

2026-10-11T07:09:00Z

Four of my Nostr apps now have native Android apps, on Zapstore:

Emanator: schedule and write posts for all your Nostr accounts, and handle the replies, mentions and private messages of every identity in one place
https://zapstore.dev/apps/today.cypherpunk.emanator

Lievik: for marketing. It reads the Nostr accounts and RSS feeds you follow, tells you what is worth passing on and to which audience (a newsletter, a Signal group, a social account), and drafts the post
https://zapstore.dev/apps/today.cypherpunk.lievik

nalgorithm (npub1dka…wkt0) : your Nostr feed ranked by what you care about, plus a daily voice digest
https://zapstore.dev/apps/today.cypherpunk.nalgorithm

Nostrautica (npub1k33…4taa) : for any event, from a conference or a meetup to a community that meets for years, built around meeting the right people
https://zapstore.dev/apps/today.cypherpunk.nostrautica

All of them sign in with Amber on the same phone. They are open source, and the signed releases are on GitHub too, so Obtainium works.

On an iPhone or a computer you don't need any of this. Each web app installs to your home screen and is the full app.

Now the @nprofile…qeaf proxy doesn't see your prompts and ...

2026-10-11T07:04:19Z

In reply to nevent1q…9uh7
_________________________

Now the routstr (nprofile…qeaf) proxy doesn't see your prompts and can't interfere with them.

Experimentally on my node, hopefully soon everywhere! (But my node has best prices from default-on nodes anyway:).

quoting
nevent1q…tkmj
During recent discussions about the security of decentralized inference through routstr (nprofile…qeaf) people raised a valid concern: how can we be sure a provider doesn't read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.

Routstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.

It works today on routstr.cypherpunk.today, through routstrd (I'm running opencode agents on it) and right in the browser, where the page does every check itself. It's new and experimental, so please try it and tell me what breaks.

Blog: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/
Try it in the browser: https://jooray.github.io/routstr-confidential-pwa/
Paper: https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf
Code: https://github.com/jooray/routstr-confidential

Model fraud and prompt surveillance fixed. #nevent1q…tkmj

2026-10-11T07:02:53Z

In reply to nevent1q…ju49
_________________________

Model fraud and prompt surveillance fixed.

quoting
nevent1q…tkmj
During recent discussions about the security of decentralized inference through routstr (nprofile…qeaf) people raised a valid concern: how can we be sure a provider doesn't read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.

Routstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.

It works today on routstr.cypherpunk.today, through routstrd (I'm running opencode agents on it) and right in the browser, where the page does every check itself. It's new and experimental, so please try it and tell me what breaks.

Blog: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/
Try it in the browser: https://jooray.github.io/routstr-confidential-pwa/
Paper: https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf
Code: https://github.com/jooray/routstr-confidential

Now without my node seeing the prompts, or having the ability to ...

2026-10-11T06:58:53Z

In reply to nevent1q…y39f
_________________________

Now without my node seeing the prompts, or having the ability to interfere with tool calls!

nevent1qqsz8tfwjjp5f20e9z70c8csdh7zdkq823qmdnmc7qtasj58aynwhrsgftkmj

Released here: ...

2026-10-11T06:57:49Z

In reply to nevent1q…t000
_________________________

Released here: nevent1qqsz8tfwjjp5f20e9z70c8csdh7zdkq823qmdnmc7qtasj58aynwhrsgftkmj

Released #nevent1q…tkmj

2026-10-11T06:57:30Z

In reply to nevent1q…wdw9
_________________________

Released

quoting
nevent1q…tkmj
During recent discussions about the security of decentralized inference through routstr (nprofile…qeaf) people raised a valid concern: how can we be sure a provider doesn't read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.

Routstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.

It works today on routstr.cypherpunk.today, through routstrd (I'm running opencode agents on it) and right in the browser, where the page does every check itself. It's new and experimental, so please try it and tell me what breaks.

Blog: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/
Try it in the browser: https://jooray.github.io/routstr-confidential-pwa/
Paper: https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf
Code: https://github.com/jooray/routstr-confidential

This exponential is something that is very hard to grasp (pun ...

2026-10-11T06:43:47Z

This exponential is something that is very hard to grasp (pun intended) for me. Yesterday I published a protocol and a library for confidential inference through proxy (Routstr). When I woke up, it is already being used by real service out there - Graspable.

https://graspable.dev/blog/a-router-that-cannot-read-your-prompts

This is amazing. It is different than my Roadstr app, but I'm ...

2026-10-10T21:08:31Z

This is amazing. It is different than my Roadstr app, but I'm gonna give this a try!

quoting
nevent1q…qc20
ROADSTR 1.0.0 IS FINALLY HERE! 🎉🚀

After countless hours of development, testing on the road and debugging... I'm incredibly excited to announce the first stable release of Roadstr!

For those who don't know it yet, Roadstr is a free, open-source, decentralized navigation app for Android, powered by **Nostr, Bitcoin Lightning, and OpenStreetMap**, with absolutely no Google dependencies.

Since v0.5.0, the project has evolved enormously. And the biggest change? Roadstr has been rewritten from Flutter to native Kotlin, with Jetpack Compose and MapLibre!

Here's what we've built along the way:

🗺️ A whole new navigation experience
- Beautiful OpenStreetMap-based maps with 3D tilt, rotation, light/dark themes, and customizable vehicle cursors.
- Possibility to choose from 4 different tier of power consumption to accomodate both entry level phones and flagships.
- Real-time turn-by-turn GPS navigation, automatic rerouting, multiple route alternatives, and multi-stop planning.
- Navigation that keeps running even when your screen is off.
- Driving, walking, and cycling routes, with OSRM, GraphHopper, and OpenRouteService support.
- Live speed limits, speed-adaptive zoom, and customizable speedometer HUDs.

🌍 OFFLINE MAPS & NAVIGATION
- Downloadable worldwide maps using Geofabrik and Shortbread MBTiles.
- A hierarchical map catalog covering continents, countries, regions, and over 34,000 cities!
- Verified, resumable downloads and local map rendering.
- Optional offline routing powered by an on-device Valhalla engine, using separate routing packages.
- Support for custom and self-hosted map catalogs.

🤖 AI VOICE GUIDANCE — WITHOUT THE CLOUD
- Natural-sounding, on-device voice navigation powered by Kokoro-82M and Piper.
- No cloud AI API required. Voice generation happens directly on your phone.
- Multilingual guidance, downloadable voice models, and adjustable voices.

⚡ NOSTR + BITCOIN LIGHTNING
- Decentralized road reports for accidents, traffic jams, hazards, police activity, and speed cameras.
- Community confirmations, report corrections, and activity notifications.
- Reports created without connectivity can be queued for later publishing.
- Send Lightning zaps to people contributing useful road information!
- Nostr Wallet Connect (NIP-47) support.
- Secure Nostr login through Amber (NIP-55) and remote bunker signers (NIP-46). Your private key stays outside Roadstr.

🔎 SMARTER EXPLORATION
- Search addresses, businesses, brands, and points of interest using OpenStreetMap.
- Natural-language searches like "restaurants near me" or "gas stations along my route."
- Detailed place information, Wikipedia integration, and contextual amenities.
- Weather information along your journey.
- Open-data public transport itineraries where supported.

💾 MORE FREEDOM & CUSTOMIZATION
- Save places, parking locations, and complete routes.
- Encrypted, optional cross-device favorites synchronization through Nostr.
- Optional SearXNG integration for web search.
- 27 supported interface languages.
- Nostr Violet and Bitcoin Orange themes, with automatic dark mode.
- Integration with Tankful for sharing destinations directly into Roadstr.

🛠️ AND A LOT OF WORK UNDER THE HOOD
- A completely rewritten native Android architecture.
- Performance and battery optimizations.
- Improved GPS handling, navigation stability, and Nostr relay resilience.
- Extensive automated testing and real-device validation.
- An in-place upgrade path from the old 0.5.x releases, preserving supported user data and settings.

And of course, Roadstr is fully open source. No proprietary navigation platform, no mandatory Google account, and no centralized Roadstr traffic-reporting server. Download the code, break it, make it better, sell it, copy it, I don't care.

This project started with a simple idea: what if navigation could be open, community-driven, and powered by decentralized technology instead of another closed ecosystem?

Today, Roadstr 1.0.0 is one big step closer to that vision.

It's still an independent project, and there's plenty more to build. But reaching the first stable release feels like a huge milestone.

Thanks to everyone who has tested Roadstr, reported bugs, shared feedback, or simply followed its development ❤️

Get the stable release from Zapstore (nprofile…zjna)

Source code: https://github.com/roadstrapp/roadstr-app/

The roads belong to everyone. Let's make navigation decentralized and as always #FuckGoogle

#Roadstr #GrowNostr #OpenStreetMap #FuckGoogle #OtherStuff

During recent discussions about the security of decentralized ...

2026-10-10T20:14:17Z

During recent discussions about the security of decentralized inference through routstr (nprofile…qeaf) people raised a valid concern: how can we be sure a provider doesn't read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.

Routstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.

It works today on routstr.cypherpunk.today, through routstrd (I'm running opencode agents on it) and right in the browser, where the page does every check itself. It's new and experimental, so please try it and tell me what breaks.

Blog: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/
Try it in the browser: https://jooray.github.io/routstr-confidential-pwa/
Paper: https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf
Code: https://github.com/jooray/routstr-confidential

maybeeeee :)

2026-10-10T19:25:23Z

In reply to nevent1q…e8h5
_________________________

maybeeeee :)

I don't agree. if I'm selling a car, I don't care if ...

2026-10-10T19:24:30Z

In reply to nevent1q…nc8l
_________________________

I don't agree. if I'm selling a car, I don't care if they crash it tomorrow. They should be good steward for their sake, but not mine. That's what the change in ownership means.

That is literally what Josh's talk covers deeply and how he ...

2026-10-10T14:16:21Z

In reply to nevent1q…l6wg
_________________________

That is literally what Josh's talk covers deeply and how he broke it (before going to the HW modifications).

Yes, I know, we are all lazy watching the videos. Watch this one.

Ja som to inak mal veľakrát ocenené v satoch, napr. na ...

2026-10-10T13:48:23Z

In reply to nevent1q…hpjh
_________________________

Ja som to inak mal veľakrát ocenené v satoch, napr. na openbazaar a tak. Ja s tým nemám problém, problém je skôr v tom, že keď Bitcoin vymoonuje, nikto mi nechce platiť rovnakú sat sadzbu. Takže musím častejšie meniť ceny.

Downside sa nebojím, lacné saty sú super.

Inak veľa produktov čo teraz launchujem oceňujem už iba v satoch: nsite-clay (nprofile…ky25), lievik.cypherpunk.today, emanator.cypherpunk.today, nalgorithm.cypherpunk.today - všetko má sats ako default. Podobne aj moja Routstr noda.

True. And I am not telling you where 2026 happening! ...

2026-10-10T13:46:18Z

True.

And I am not telling you where 2026 happening!

Hackni sa! je teraz aj audiokniha: 14 hodín a 25 minút, 47 ...

2026-10-10T10:37:39Z

Hackni sa! je teraz aj audiokniha: 14 hodín a 25 minút, 47 kapitol, m4b aj mp3.

Podnikanie, sloboda, biohacking, kryptomeny a pár vecí, ktoré som sa za tie roky naučil o tom, ako sa pozerať na svet inak. Text je trochu aktualizovaný oproti tlačenej knihe.

Do konca októbra za 19,99 € namiesto 24,99 €:

https://juraj.bednar.io/product/hackni-sa/?attribute_typ=audiokniha

Well, this is the one that is not a clone. I think they made the ...

2026-10-10T08:48:54Z

In reply to nevent1q…dg7a
_________________________

Well, this is the one that is not a clone. I think they made the other slop clones to promote their service.

And to be fair, this is the only thing you can sell these days - inference.

Nope, it's not. But it re-uses the same idea of peer.xyz ...

2026-10-10T08:47:47Z

In reply to nevent1q…uw72
_________________________

Nope, it's not.

But it re-uses the same idea of peer.xyz proofs for a completely different domain.

There's no structured decoding, it's just raw outputs. ...

2026-10-10T08:46:30Z

In reply to nevent1q…ynj3
_________________________

There's no structured decoding, it's just raw outputs. There's nothing to decode. This is not LLM!

You don't get JSON or anything like that. You get the raw numbers. The worst that can happen is that the numbers are wrong (and something that should have been blocked is not).

Re: Ledger supply chain attack. A friend @nprofile…698f was ...

2026-10-10T08:23:40Z

Re: Ledger supply chain attack.

A friend bitpunk.fm is typing (nprofile…698f) was talking about exactly this supply chain attack 8 years ago at CCC:

https://www.youtube.com/watch?v=Y1OBIGslgGM

They downplayed him that he was "too James Bond". Well, the bounty increased and apparently "too James Bond" is an economical thing to do.

The seller of the company got lots of shit for selling the company, but I think this is wrong. It is Ledger's job to verify the supply chain (and keep things like notification of ownership change in the contract). It's not the previous owners' job. The contract is with the supplier, not with the owners.

Personal storytime:

There’s nothing wrong with selling a company - sure, you are selling the users, but nothing in the world forces you to own a company forever. Many entrepreneurs are building a "bankable business" (something you can sell - in contrast with "lifestyle business" - which pays the bills). And what happens to the company afterward really isn’t their problem anymore.

When I was selling my company, a friend did this nice little exercise with me. We were really stressing about who would buy it and whether it would be cool. He talked about valuation — there’s some research where you have an IKEA cup worth $2 and you’re asked whether you’d buy it. If they gave that cup to someone for a month and then had them sell it, they valued it higher (something like $4, I don’t remember the exact numbers), because it was no longer just a “random IKEA cup” — they had to part with *their* cup.

He explained to us that what we are doing is a rational transaction: we don’t want the company anymore, we want money instead, so we sell it, and then it’s not ours. What the new owner does with it has absolutely nothing to do with us. Whether the employees and customers stay happy is their problem, and we bear zero responsibility for whatever happens to the company afterward. The "due diligence" goes usually one way - the buyer wants to know about the company they are buying. The only thing you want to know about the seller is if they'll pay agreed amount.

So that reseller — in my view, basically didn’t do anything wrong. Ledger should have had this covered in the contract and properly vetted those suppliers, continuously. Ledger had a contract with a legal entity and didn’t bother checking at all whether they were up to no good.

I don't think it is possible to check the supply chain well though.

Anyway, Josh was right again. Listen to bitpunk.fm and you'll realise he's very often right.

Trying to build something cool with zero knowledge proofs. Kimi ...

2026-10-09T10:41:00Z

Trying to build something cool with zero knowledge proofs.

Kimi and DeepSeek are grinding now.

(Image by redshift (nprofile…9pn9))

Experimental ArtCraft fork that does not need ArtCraft cloud ...

2026-10-09T09:52:00Z

Experimental ArtCraft fork that does not need ArtCraft cloud accounts and uses @AskVenice models.

Done entirely by DeepSeek V4.1 Flash, no "frontier" models used in this.

Doesn't do the 3D parts, because Venice does not offer 3D models yet.

Price estimation, models, etc. should work. Keep the pull requests coming.

https://github.com/jooray/artcraft

Toto je brutál! ♨️♨️♨️ #nevent1q…9fjx

2026-10-08T18:21:07Z

Toto je brutál!

♨️♨️♨️

quoting
nevent1q…9fjx
Payky je zase o kus blíž každodennímu provozu. Prodej i evidenci v EET 2.0 zvládne obchodník i z prohlížeče. Bezpečnost, 100% otevřenost (opensource), soukromí a nezávislost zůstávají našimi prioritami. Teď nasloucháme prvním podnikům a připravujeme další kroky.

nevent1q…a7g5

Turns out we can just do things!

2026-10-08T18:14:44Z

In reply to nevent1q…md6m
_________________________

Turns out we can just do things!

Democracy in one picture ...

2026-10-08T14:01:00Z

Democracy in one picture

Someone asked whether I use Jev. Yes — in five places already. ...

2026-10-08T09:01:00Z

Someone asked whether I use Jev. Yes — in five places already.

Jev is a decision model, not a chat model. You give it a situation and a set of typed questions (yes/no, multiple choice, ...), and it returns calibrated probabilities instead of generated text. Sub-second responses, input-token-only pricing, and it cannot answer outside the options you define. Where you'd otherwise ask an LLM for one JSON field and throw the rest away, this is the thing to call.

Where I use it:

1. Security for my AI agent. Hermes reads untrusted pages and emails, so any of that text could carry planted instructions. The hermes-firewall plugin extracts everything the model would see (invisible Unicode, hidden HTML, OCR of images, base64) and asks Jev two questions: is there a command here unrelated to the content, and is it aimed at an AI? On a 718-item benchmark it caught 89% of attacks at 3.5% false positives, ahead of DeBERTa, a 421M local classifier and a 4B instruction model. About $0.035 per thousand scans.
https://juraj.bednar.io/en/blog-en/2026/09/28/a-prompt-injection-gate-for-my-ai-agent-what-worked-what-didnt-and-the-benchmark/

2. Marketing automation. Lievik watches my content sources and rates every post against each audience (newsletter, Signal group, students) from 0 to 100 for relevance, so I know what to send whom and what they've already seen.
https://lievik.cypherpunk.today

3. Nostr feed ranking. Nalgorithm scores posts from my follows against a profile of what I actually care about, instead of serving reverse-chronological order. A 602-post feed scores in 21 seconds instead of ~5 minutes, with 271 distinct scores instead of 11, and a rerun keeps the same order.
https://nalgorithm.cypherpunk.today/

4. Event networking. Nostrautica connects attendees with people they should meet. On a real 39-person roster the old scorer gave 19 of them a tied first place; Jev gave nobody a tie and reproduced the order across runs.
https://nostrautica.cypherpunk.today/

5. Signal group summaries. signal-summarizer turns a busy Signal group into a themed digest: it reads the text, transcribes voice notes, has a vision model describe the images and summarizes the links, then files all of it into topics. Jev handles the part that's easy to get wrong — deciding whether two themes are actually the same topic, and routing a message into the right one. On a labelled fixture it separated real merges from near-misses with AUC 1.00, ahead of plain embedding similarity, and it matched strong LLM judges on routing.
https://github.com/jooray/signal-summarizer

In all of these Jev is just one option. Each project can swap in another decision model (there are open ones you can run locally in Ollama, no cloud needed) or a plain LLM, whichever fits the job.

We now have a magic wand. I was able to implement Jev in all these projects almost immediately after the model went out, including the benchmarks. This would have taken weeks without AI for coding.

I benchmarked Liquid AI's new open decision models, d1-3B and ...

2026-10-08T05:15:00Z

I benchmarked Liquid AI's new open decision models, d1-3B and d1-omni-600M, as local prompt-injection gates for my Hermes agent, along with Decision-2.0-Lux-9B in MLX. d1-3B is quick on my M2 Max (0.3 s a message, against about 2 s for Nimble) and separates attacks from benign text well within each kind of content, with the best image score of anything I've tested. But its scores don't line up across content types: half of the emails with a planted instruction score lower than some ordinary Nostr posts, so with one threshold it blocks only 29 of 150 of those emails. Lux has a different problem: it treats articles about prompt injection as prompt injection. d1-omni-600M is too weak to use.

My recommendation hasn't changed: use Jev on Venice if you can (it blocks 88% of attacks and 92% of planted email instructions), and Nimble 9B 4-bit in Ollama if everything has to stay local. I also tried giving d1 the image itself instead of OCR text, and OCR won (40 against 28 of 48 image attacks blocked), so the OCR step stays.

Numbers and charts: https://juraj.bednar.io/en/blog-en/2026/09/28/a-prompt-injection-gate-for-my-ai-agent-what-worked-what-didnt-and-the-benchmark/#d1
Plugin and benchmark: https://github.com/jooray/hermes-firewall

I was saying @nprofile…etsy is more expensive than ...

2026-10-07T21:02:46Z

I was saying PPQdotAI (nprofile…etsy) is more expensive than routstr (nprofile…qeaf) in many cases. But what is underappreciated is that PPQ supports much more than text inference, and Routstr is not there yet. Image generation, video, ...

There are some sparks on Routstr, but the model catalog of PPQ is impressive. Again - no accounts model, no KYC is the way to go.

Wow

2026-10-07T20:22:15Z

In reply to nevent1q…dptt
_________________________

Wow

Yes, just download from the web. It will then autoupdate. I ...

2026-10-07T16:30:07Z

In reply to nevent1q…kmev
_________________________

Yes, just download from the web. It will then autoupdate.

I don't recommend fdroid, they're known to use old and possibly vulnerable libraries for building the apps.

I'm quite well known for giving zero fucks about "average ...

2026-10-06T07:50:17Z

In reply to nevent1q…fnw4
_________________________

I'm quite well known for giving zero fucks about "average user". Being average is a diagnosis and I'm sorry for the people who have to be average and endure an average life. I wish them well, but otherwise my approach is not to interfere.

About the apps - I make them for myself, and as a gift, I publish them. I don't care about many users, if they want to benefit, it's there, for free. If not, I'm fine benefiting alone.

The post was to tell people I give them a gift and how to access my gifts and gifts of others.

We @nprofile…kjtv

2026-10-06T06:54:36Z

In reply to nevent1q…2z66
_________________________

We Zapstore (nprofile…kjtv)

If you are not using ZapStore on Android, you are missing out. ...

2026-10-06T06:31:55Z

If you are not using ZapStore on Android, you are missing out. Many developers including myself just value their time and sanity so much that we can't be bothered by Google and Apple bullshit.

That means, you don't get our apps if you don't ZapStore (or Obtainium, but honestly, ZapStore has way better ux). And the apps are usually free.

Here are mine, and much more to come:
https://zapstore.dev/profile/npub1m2mvvpjugwdehtaskrcl7ksvdqnnhnjur9v6g9v266nss504q7mqvlr8p9

One pull request to be able to select model in opencode. But I ...

2026-10-05T13:46:05Z

In reply to nevent1q…9vnk
_________________________

One pull request to be able to select model in opencode.

But I have not played too much with it.

Also, the instructions for Claude Code are not in the app interface, although they are linked from the web.

I find it super funny that most open source development is ...

2026-10-05T13:45:35Z

I find it super funny that most open source development is happening on Microsoft infrastructure (github).

The Universe surely must be having fun with us :)

(And kudos to Microsoft for coming around and realising we were right all along:).

Or - would anyone be interested in Monero denominated cashu mint, ...

2026-10-05T12:22:10Z

In reply to nevent1q…h869
_________________________

Or - would anyone be interested in Monero denominated cashu mint, fundable with Monero on chain? And interoperable with lightning? But you keep your balance in xmr.

I might look for funding for that if anyone is interested.

Does Monero have working community grants?

I've done some digging into it, so if you want some info, let ...

2026-10-05T11:02:54Z

In reply to nevent1q…kvlr
_________________________

I've done some digging into it, so if you want some info, let me know

It's good, slightly unexpected, cache usually lasts for ...

2026-10-05T11:01:18Z

In reply to nevent1q…5umh
_________________________

It's good, slightly unexpected, cache usually lasts for minutes.

Achievement unlocked: I got scammed in Austria. Used to be high ...

2026-10-05T11:00:00Z

Achievement unlocked: I got scammed in Austria.

Used to be high trust society.

Now just enjoying the decline...

Thankfully only 23€

Ah, yes, this could work. The problem with TLSNotary in general ...

2026-10-05T09:46:39Z

In reply to nevent1q…qytn
_________________________

Ah, yes, this could work.

The problem with TLSNotary in general is that because of symmetric key is used for both sides, you can't really tell apart if client or server sent something, but this could work.

But you still need some form of masking (either whitelist or blacklist), if you want to prove that the plaintext contains the model you chose in API request, or alternatively mask out the API keys used (and reveal everything else).

That's what I like about Peer's solution, you can selectively reveal parts of TLS plaintext while hiding other parts, yet still making sure that the upstream TLS connection has not been tampered with.

Honestly, I don't know. I know @nprofile…dmgd runs it and ...

2026-10-05T09:43:02Z

In reply to nevent1q…zk68
_________________________

Honestly, I don't know.

I know _honza_dvorak (nprofile…dmgd) runs it and he's super reputable and cool.

But ToC says: "This mint will rug you 😉 "

For me, regular payouts to lightning are very important feature while using any Cashu mint.

This is so cool! #naddr1qv…wwdu

2026-10-05T07:41:37Z

This is so cool!

quoting
naddr1qv…wwdu

Nostr Community Zine 10/26

Created by the Nostr community Produced by No Good Kid

Dear New Nostrich

by Tanja (npub1hz5…tysa)

Dear new Nostrich,

Maybe you just arrived: no npub tattoo yet, still not sure whether this is really different from everything else you know. I was there too. Here's what nobody told me when I started:

Nostr isn't a product you use. It's a space you help build.

There's no company deciding whether your voice counts: just real people, actually listening, not because an algorithm forced them to, but because they chose to.

Through Nostr, I found my voice.

My advice: don't go looking for Nostr online. Go outside: to a meetup, a lounge, a zine like this one. The energy you're searching for doesn't live just in the feed. It lives also in rooms where real people dare to be real.

Welcome. This space is yours too.

—Tanja

by existing sprinkles (npub1f5k…vk2u)

The Person Three Tables Away

by Nostrautica (npub1k33…4taa)

It usually goes like this: you spend a whole day at an event surrounded by interesting people, talk to whoever happens to be standing near the coffee, and only later discover that the person you really should have met was three tables away.

Nostrautica gives organizers a way to help their people find each other, not just gather in the same place. It now supports communities as well as events, and it’s free to use, including for events you organize yourself.

Introduce yourself with a few written lines, audio, or a short video. Nostrautica connects it with your public Nostr activity and points you towards people you may actually have something to talk about with, along with a simple explanation of why.

Sometimes that one conversation is the whole reason for being there.

Check it out: nostrautica.cypherpunk.today

—Nostrautica

"You were tired of playing a losing game, it's 4D chess and now you've called Checkmate"

by Joe Martin (npub19r9…eukr)

I'm Joe Martin,

a 21st century troubadour telling my story through song and looking at ways technology can work for artists instead of against them. On my quest I discovered bitcoin and the concept of value for value, releasing your content on open protocols such as RSS and nostr and asking listeners to send value back in the form of sats. I think this is the purest and most direct way to monetise your work and creates an instant connection between artist and audience.

I think most artists are tired of the old way of doing things and it hasn't worked for the vast majority of us. So let's take a leap into this brave new world and own our own content and money with this new, empowering technology of bitcoin and nostr. When the implications of this new way of doing things is realised by the masses, it's game over, checkmate for the old system.

To take a line from a song off my new album Alone In Valentine;

"You were tired of playing a losing game, it's 4D chess and now you've called Checkmate"

—Joe

What Creation Asks of Us

by npub12ca2xp6m2ljha277snztrruyge5ewjcvu8tr3570xtmpr9wt9ycsdmlnhu (npub12ca…lnhu)

Recent events have left many in the Bitcoin community grieving. A Coldcard firmware bug weakened seed generation. Thousands of addresses were drained. Those who lost funds did nothing wrong. They trusted a respected tool and met a vulnerability they could not anticipate.

This grief is not only about stolen bitcoin. These are moments that cut deeper than code. They remind us how human every creation is. Every creation carries its creator. Creation asks presence of us: care, attention, and the courage to let other eyes complete what we began.

At Bitcoiner Talent, this clarified my work: gathering people whose character becomes part of what they create.

We were never meant to walk this alone. Let’s build with warmth… let’s meet on Nostr where you can continue reading on my profile.

—Elizabeth

rust

by AJ (npub1xff…t6y0)

the damage spreads slowly, invisibly strong and solid becomes feeble and weak

the damage is easy to fix but the tools are all wrong

the damage just needs a moment of focus but distractions and worries mean the focus never comes

the damage takes hold and breaks this in two because a letter is missing

—AJ

by sifrant (npub13cd…ptf8) & Dodavkacka (npub16k9…8n63)

It’s bigger than I am, and it’s uncertain. But I’m here for it.

by franny (npub1995…8vtf)

Hey, my name is Franny!

I grew up on a farm in a peaceful village in Germany. While everything seems to go higher, faster and wider, I crave so little to thrive. And yet, so much of my time and energy goes into keeping up with a huge system that seems to demand more and more.

What I actually care about is...

...time, for myself and for the environment that counts on me.

...connection to the things I have on my plate and where I put my energy in.

...freedom to be and to care for each other.

I am mad at the fact that I need to take care of this huge system while I am needed here, in my local area. By the ecosystem and the people around me. But so much of the system we depend on is not made for the locals anymore. I always felt deeply connected to the earth and its beings. And maybe that’s also why I am drawn to things that give us a little more agency over the systems we depend on.

So I am really glad about the following two things: There is Bitcoin and there is Nostr. Bitcoin gives me hope that money can exist by rules that are transparent and measurable, instead of rules that can simply be changed by those in power. Nostr is much more experimental, still. But there lies so much potential. It’s a decentralized identity protocol. To me, it means that my identity online doesn’t have to belong to a platform. It is based on a key that I can take with me across different apps and places on Nostr. No single company needs to own the space in which I connect with other people.

But why do we need to be online, anyway? I can only answer that for myself. I am online because I am looking for other people who also want to strengthen their local communities and ecosystems. I am part of a group that organizes meetups in and around Germany, to bring people together. People who feel a similar tension about the systems we depend on, and who want to figure out a different way of doing things.

And I like photography, so I share what I see through my lens. Plus deep thoughts and shitposts.

I have shared stuff like this specifically with this weirdly hopeful corner of the internet for three and a half years now. I made friends along the way. People I eventually met in real life. We cooked meals together and shared life stories. It’s meaningful, because we see so much hope in each other. At first, it might seem a little backwards to spend time supporting an online community in order to strengthen local communities. But for me, it’s not. This community inspires me in so many ways. It gives me intellectual and emotional strength to put energy into the place where I actually live.

People who might have never found each other otherwise, suddenly realize how much they have in common. Ideas get shared, people help each other, we just figure out and use these tools that give power back to the people. Maybe that’s what I find so interesting about Nostr.

It doesn’t have to become another place that keeps us online. Maybe it can be infrastructure that helps us connect each other, without needing a central platform to organize our relationships for us. I hope I can do my part to strengthen the people. Maybe from that, over time, we can build more local and circular economies, meaningful crafts, stronger communities and lives that feel a little more connected to what actually matters.

It’s bigger than I am, and it’s uncertain. But I’m here for it. And I am thankful to form it along the way.

—Franny

A need is identified

by Audeltk (npub1q0e…spsx)

A need is identified A promise is made. The community comes together. Bitcoin turns that promise into action.

Then comes the impact: a child helped, a smile restored, a life touched.

And we don’t stop there. We come back, we share the results, we learn, we update and we keep building hope.

Observe. Promise. Collect. Act. Impact. Recap. Repeat.

This is how Hope With ₿itcoin (npub10vs…9eap) works.

—Audel TK

None of this is clever

by Freedom Tech Co. (npub1frd…h4dd) & Nostr Dev Team (npub1yay…trdv)

Seven field-tested habits for building on bitcoin and nostr, from a freedom-tech dev shop.

1. The network is the documentation

There's a trap that catches so many outsiders: assuming you need a merged NIP before you can use a kind number. You don't — the specs describe what the network already does; they don't decide what it's allowed to do. Curious which kinds are actually alive? Watch the relays. A working kind nobody documented beats an unused documented kind, every time.

2. Ship before you're done

Don't try to build everything nostr can do into your first release — it can do everything, and that's another trap. Get a working product out the door and improve it in public. Your users forgive missing features; they don't wait around for perfect ones. Perfectionism is centralised thinking — a habit of waiting for permission, and you can drop it. Shipping is permissionless.

3. Fixed price is rarely a good deal

If you're commissioning software, be wary of a fixed quote. Hourly keeps everyone honest: you participate in the build, pay for what actually gets built, and the money goes into working software — not padding estimates or cutting corners to stay inside one.

4. No spyware in the workshop

Host your own tools. Then steal our one hard rule — it does more work than any manifesto: no phone numbers, no fiat. If a tool demands either, find another tool. Yes, including Signal and Telegram — phone numbers are the account system of everything you left behind, or are about to. And when you pay sats, there is no payment data — nothing for your bank to log and sell.

5. Bitcoin is the alignment test

You can't hire for nostr off a CV — devs with years of nostr experience barely exist, because nostr hasn't had years to give. If you're building a team, pay in bitcoin. People who take it have already done the thinking about money, time, and why any of this gets built. Skills can be developed. Alignment can't be bought — and nothing matters more.

6. Nobody here clicks ads

You cannot advertise your way into this community: nostr users installed an ad blocker over the whole internet and kept walking. So how do you reach anyone? The same way everyone here did — ship in public, genuinely live on nostr, make zaps, show up. Collect nostr addresses instead of business cards. Assume the venue wifi is hostile. It usually is.

7. Relays are not archives. Deletes are not deletes.

A free relay stores your notes out of courtesy, not duty — it can vanish tomorrow, and your posts with it. And on nostr, deletion is a request, not an act: you can ask every relay to forget a note, but anyone who copied it first keeps it forever. Self-sovereignty means you design for both facts from day one — run or fund the relays you depend on, and never sign what you can't live with being copied.

If one of these habits stung, that's the one to start with. None of this is clever. All of it works.

See you on the relays.

—Nostr devs

by BitPopArt (npub1gwa…a2sz)

Print the zine!

Print the zines and give them away at your meetup!

Print data (A3 format): https://nogoodkid.com/nostrzine1026.pdf

Enjoy!

NGK